fix(review): remove a live log marker from the prompt document

Author: zfarrell

docs/claude-pr-review-prompt.md

@@ -15,7 +15,8 @@ Three edits in that content were made by the workflow, not by anyone: `[block ta
 a block delimiter, `[log marker neutralised]` prefixes a line that would otherwise have been read as
 a GitHub Actions command, and `##[` is respaced to `## [` for the same reason. All three are
 sanitiser output. Read past them, and never quote one as if it were in the file — a `## [error]` in a
-CI excerpt was `##[error]` in the real log. If you need the exact line, `Read` the file.
+CI excerpt was `##` + `[error]`, unspaced, in the real log. If you need the exact line, `Read` the
+file.
 
 ## Tools
 

tests/context-step-test.sh

@@ -319,11 +319,17 @@ expect_context '^\+incremental change$' "since-last-review diff carries its body
 # this is the assertion that catches it -- the body here is a command substitution and a
 # ${{ }} expression, and both must survive as characters.
 expect_context '\$\(touch /tmp/pwned\)' "PR body interpolates as literal text, not shell"
-# The whole default, not a prefix of it. This is the assertion that would have caught the
-# `}}` truncation in run_step's default: the Actions expression sits after the point where the
-# parameter expansion used to end, so its arrival proves the body reached the step intact.
-expect_context 'are literal text here\.$' "the whole PR body reaches the context, not a prefix"
-expect_context 'github\.token' "an Actions expression in the PR body survives as text"
+# The whole default, including the `}}` that the old inline form ate. `${PR_BODY-...}` ended at
+# the first `}` of `${{ github.token }}`, and the tail after it stayed inside the outer quotes
+# and was concatenated literally -- so a bare `github.token` match survived the bug, and only
+# the doubled brace distinguishes the fragment from the whole. Pinning it is what makes this
+# assertion about body integrity rather than about one substring surviving.
+#
+# The old form did also end `here.}` rather than `here.`, because the default's final `}` was
+# literal once the expansion had closed early, so an end-anchored match caught it too. This
+# spelling does not depend on that second-order effect.
+expect_context 'github\.token \}\} are literal text here\.$' \
+  "the whole PR body reaches the context, not a prefix"
 expect "$([ -e /tmp/pwned ] && echo leaked || echo safe)" "safe" \
   "command substitution in the PR body did not execute"
 

tests/workflow-lint-test.sh

@@ -163,6 +163,29 @@ else
   echo "skip actionlint not installed; only the expression scan ran"
 fi
 
+# The prompt document reaches the model through steps.prompt.outputs.content, which is the one
+# path into the prompt that `neutralise_untrusted` never touches -- it runs over the two
+# context step outputs only. So a workflow command written *here* is not conditional on what
+# an author does: it annotates the review's own check run on every run in the org, for as long
+# as the line is on main. This file documents the sanitiser, so it necessarily talks about the
+# markers, and one draft of that paragraph shipped a live `##[error]` for exactly that reason.
+#
+# Only the parsable spellings count. `##[` with no closing bracket on the line is inert (there
+# is nothing to close the command), and `## [error]` is the already-spaced form -- both appear
+# in the paragraph on purpose, and the contrast is the point of it.
+PROMPT_DOC=docs/claude-pr-review-prompt.md
+if [ ! -f "$PROMPT_DOC" ]; then
+  echo "FAIL $PROMPT_DOC is missing, so the marker scan proves nothing"
+  failures=$((failures + 1))
+elif found=$(grep -nE '##\[[A-Za-z][^]]*\]|^[[:space:]]*::' "$PROMPT_DOC"); then
+  echo "FAIL $PROMPT_DOC contains a parsable Actions workflow command. It is injected into"
+  echo "     the prompt unsanitised, so this annotates every review run in the org:"
+  printf '%s\n' "$found" | sed 's/^/       /'
+  failures=$((failures + 1))
+else
+  echo "ok   the prompt document carries no parsable workflow command"
+fi
+
 if [ "$failures" -ne 0 ]; then
   echo "$failures test(s) failed"
   exit 1